I've been comparing 2 S9, a working one and the hacked one, you can see the log monitor in https://pastebin.com/74qBhhi1.

It's weird that {m5} eth1 /root/m5, eating CPU and being repeated many times....

any ideas to solve this?

Thanks!!